include/asm-x86/futex.h in the Linux kernel before 2.6.25 does not properly implement exception fixup, which allows local users to cause a denial of service (panic) via an invalid application that triggers a page fault.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities in several third-party components and libraries :

  - Kernel
  - krb5
  - glibc
  - mtp2sas
  - mptsas
  - mptspi

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0039 for details.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0839 advisory.

    - [net] rds: fix local privilege escalation (Eugene Teo) [642897 642898] {CVE-2010-3904}
    - [misc] futex: replace LOCK_PREFIX in futex.h (Peter Zijlstra) [633175 633176]       {CVE-2010-3086}
    - [v4l] remove compat code for VIDIOCSMICROCODE (Mauro Carvalho Chehab) [642470       642471] {CVE-2010-2963}
    - [net] sched: fix info leak in traffic policing (Neil Horman) [636391 636392]       {CVE-2010-3477}
    - [fs] aio: check for multiplication overflow in io_submit (Jeff Moyer) [629448       629449] {CVE-2010-3067}
    - [fs] xfs: prevent reading uninitialized stack memory (Dave Chinner) [630806        630807] {CVE-2010-3078}
    - [fs] aio: fix cleanup in io_submit_one (Jeff Moyer) [631720 631721]       {CVE-2010-3066}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes the following security issues :

  - A NULL pointer dereference flaw was found in the     io_submit_one() function in the Linux kernel     asynchronous I/O implementation. A local, unprivileged     user could use this flaw to cause a denial of service.
    (CVE-2010-3066, Moderate)

  - A flaw was found in the xfs_ioc_fsgetxattr() function in     the Linux kernel XFS file system implementation. A data     structure in xfs_ioc_fsgetxattr() was not initialized     properly before being copied to user-space. A local,     unprivileged user could use this flaw to cause an     information leak. (CVE-2010-3078, Moderate)

  - The exception fixup code for the __futex_atomic_op1,
    __futex_atomic_op2, and futex_atomic_cmpxchg_inatomic()     macros replaced the LOCK prefix with a NOP instruction.
    A local, unprivileged user could use this flaw to cause     a denial of service. (CVE-2010-3086, Moderate)

  - A flaw was found in the tcf_act_police_dump() function     in the Linux kernel network traffic policing     implementation. A data structure in     tcf_act_police_dump() was not initialized properly     before being copied to user-space. A local, unprivileged     user could use this flaw to cause an information leak.
    (CVE-2010-3477, Moderate)

  - A missing upper bound integer check was found in the     sys_io_submit() function in the Linux kernel     asynchronous I/O implementation. A local, unprivileged     user could use this flaw to cause an information leak.
    (CVE-2010-3067, Low)

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

This kernel update for the SUSE Linux Enterprise 10 SP3 kernel fixes several security issues and bugs.

The following security issues were fixed :

  - Multiple integer overflows in the snd_ctl_new function     in sound/core/control.c in the Linux kernel before     2.6.36-rc5-next-20100929 allow local users to cause a     denial of service (heap memory corruption) or possibly     have unspecified other impact via a crafted (1)     SNDRV_CTL_IOCTL_ELEM_ADD or (2)     SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call. (CVE-2010-3442)

  - Integer signedness error in the pkt_find_dev_from_minor     function in drivers/block/pktcdvd.c in the Linux kernel     before 2.6.36-rc6 allows local users to obtain sensitive     information from kernel memory or cause a denial of     service (invalid pointer dereference and system crash)     via a crafted index value in a PKT_CTRL_CMD_STATUS ioctl     call. (CVE-2010-3437)

  - Uninitialized stack memory disclosure in the     FBIOGET_VBLANK ioctl in the sis and ivtv drivers could     leak kernel memory to userspace. (CVE-2010-4078)

  - Uninitialized stack memory disclosure in the rme9652     ALSA driver could leak kernel memory to userspace.
    (CVE-2010-4080 / CVE-2010-4081)

  - Uninitialized stack memory disclosure in the SystemV IPC     handling functions could leak kernel memory to     userspace. (CVE-2010-4073 / CVE-2010-4072 /     CVE-2010-4083)

  - Integer overflow in the do_io_submit function in     fs/aio.c in the Linux kernel allowed local users to     cause a denial of service or possibly have unspecified     other impact via crafted use of the io_submit system     call. (CVE-2010-3067)

  - Multiple integer signedness errors in net/rose/af_rose.c     in the Linux kernel allowed local users to cause a     denial of service (heap memory corruption) or possibly     have unspecified other impact via a rose_getname     function call, related to the rose_bind and rose_connect     functions. (CVE-2010-3310)

  - The xfs_swapext function in fs/xfs/xfs_dfrag.c in the     Linux kernel did not properly check the file descriptors     passed to the SWAPEXT ioctl, which allowed local users     to leverage write access and obtain read access by     swapping one file into another file. (CVE-2010-2226)

  - fs/jfs/xattr.c in the Linux kernel did not properly     handle a certain legacy format for storage of extended     attributes, which might have allowed local users by     bypass intended xattr namespace restrictions via an     'os2.' substring at the beginning of a name.
    (CVE-2010-2946)

  - The actions implementation in the network queueing     functionality in the Linux kernel did not properly     initialize certain structure members when performing     dump operations, which allowed local users to obtain     potentially sensitive information from kernel memory via     vectors related to (1) the tcf_gact_dump function in     net/sched/act_gact.c, (2) the tcf_mirred_dump function     in net/sched/act_mirred.c, (3) the tcf_nat_dump function     in net/sched/act_nat.c, (4) the tcf_simp_dump function     in net/sched/act_simple.c, and (5) the tcf_skbedit_dump     function in net/sched/act_skbedit.c. (CVE-2010-2942)

  - fs/cifs/cifssmb.c in the CIFS implementation in the     Linux kernel allowed remote attackers to cause a denial     of service (panic) via an SMB response packet with an     invalid CountHigh value, as demonstrated by a response     from an OS/2 server, related to the CIFSSMBWrite and     CIFSSMBWrite2 functions. (CVE-2010-2248)

  - A 32bit vs 64bit integer mismatch in gdth_ioctl_alloc     could lead to memory corruption in the GDTH driver.
    (CVE-2010-4157)

  - A remote (or local) attacker communicating over X.25     could cause a kernel panic by attempting to negotiate     malformed facilities. (CVE-2010-4164)

  - A missing lock prefix in the x86 futex code could be     used by local attackers to cause a denial of service.
    (CVE-2010-3086)

  - A memory information leak in berkely packet filter rules     allowed local attackers to read uninitialized memory of     the kernel stack. (CVE-2010-4158)

  - A local denial of service in the blockdevice layer was     fixed. (CVE-2010-4162)

a. ESX third-party update for Service Console kernel

   This update takes the console OS kernel package to    kernel-2.6.18-238.9.1 which resolves multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-1083, CVE-2010-2492, CVE-2010-2798,    CVE-2010-2938, CVE-2010-2942, CVE-2010-2943, CVE-2010-3015,    CVE-2010-3066, CVE-2010-3067, CVE-2010-3078, CVE-2010-3086,    CVE-2010-3296, CVE-2010-3432, CVE-2010-3442, CVE-2010-3477,    CVE-2010-3699, CVE-2010-3858, CVE-2010-3859, CVE-2010-3865,    CVE-2010-3876, CVE-2010-3877, CVE-2010-3880, CVE-2010-3904,    CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080,    CVE-2010-4081, CVE-2010-4083, CVE-2010-4157, CVE-2010-4158,    CVE-2010-4161, CVE-2010-4238, CVE-2010-4242, CVE-2010-4243,    CVE-2010-4247, CVE-2010-4248, CVE-2010-4249, CVE-2010-4251,    CVE-2010-4255, CVE-2010-4263, CVE-2010-4343, CVE-2010-4346,    CVE-2010-4526, CVE-2010-4655, CVE-2011-0521, CVE-2011-0710,    CVE-2011-1010, CVE-2011-1090 and CVE-2011-1478 to these issues.

b. ESX third-party update for Service Console krb5 RPMs

   This patch updates the krb5-libs and krb5-workstation RPMs of the    console OS to version 1.6.1-55.el5_6.1, which resolves multiple    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-1323, CVE-2011-0281, and CVE-2011-0282    to these issues.

c. ESXi and ESX update to third-party component glibc

   The glibc third-party library is updated to resolve multiple    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-0296, CVE-2011-0536, CVE-2011-1071,    CVE-2011-1095, CVE-2011-1658, and CVE-2011-1659 to these issues.

d. ESX update to third-party drivers mptsas, mpt2sas, and mptspi

   The mptsas, mpt2sas, and mptspi drivers are updated which addresses    multiple security issues in the mpt2sas driver.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2011-1494 and CVE-2011-1495 to these issues.

Tavis Ormandy discovered that the Linux kernel did not properly implement exception fixup. A local attacker could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-3086)

Dan Rosenberg discovered that the Linux kernel TIPC implementation contained multiple integer signedness errors. A local attacker could exploit this to gain root privileges. (CVE-2010-3859)

Dan Rosenberg discovered that the Linux kernel X.25 implementation incorrectly parsed facilities. A remote attacker could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-3873)

Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-3875)

Vasiliy Kulikov discovered that the Linux kernel sockets implementation did not properly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-3876)

Nelson Elhage discovered that the Linux kernel IPv4 implementation did not properly audit certain bytecodes in netlink messages. A local attacker could exploit this to cause the kernel to hang, leading to a denial of service. (CVE-2010-3880)

Dan Rosenberg discovered that the SiS video driver did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4078)

Dan Rosenberg discovered that the RME Hammerfall DSP audio interface driver did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4080, CVE-2010-4081)

Dan Rosenberg discovered that the semctl syscall did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4083)

James Bottomley discovered that the ICP vortex storage array controller driver did not validate certain sizes. A local attacker on a 64bit system could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-4157)

Dan Rosenberg discovered that the Linux kernel L2TP implementation contained multiple integer signedness errors. A local attacker could exploit this to to crash the kernel, or possibly gain root privileges.
(CVE-2010-4160).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A NULL pointer dereference flaw was found in the io_submit_one() function in the Linux kernel asynchronous I/O implementation. A local, unprivileged user could use this flaw to cause a denial of service.
(CVE-2010-3066, Moderate)

* A flaw was found in the xfs_ioc_fsgetxattr() function in the Linux kernel XFS file system implementation. A data structure in xfs_ioc_fsgetxattr() was not initialized properly before being copied to user-space. A local, unprivileged user could use this flaw to cause an information leak. (CVE-2010-3078, Moderate)

* The exception fixup code for the __futex_atomic_op1,
__futex_atomic_op2, and futex_atomic_cmpxchg_inatomic() macros replaced the LOCK prefix with a NOP instruction. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2010-3086, Moderate)

* A flaw was found in the tcf_act_police_dump() function in the Linux kernel network traffic policing implementation. A data structure in tcf_act_police_dump() was not initialized properly before being copied to user-space. A local, unprivileged user could use this flaw to cause an information leak. (CVE-2010-3477, Moderate)

* A missing upper bound integer check was found in the sys_io_submit() function in the Linux kernel asynchronous I/O implementation. A local, unprivileged user could use this flaw to cause an information leak.
(CVE-2010-3067, Low)

Red Hat would like to thank Tavis Ormandy for reporting CVE-2010-3066, CVE-2010-3086, and CVE-2010-3067, and Dan Rosenberg for reporting CVE-2010-3078.

This update also fixes several bugs. Documentation for these bug fixes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2010-0839.

ID	Name	Product	Family	Severity
89680	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0012) (remote check)	Nessus	Misc.	high
79507	OracleVM 2.2 : kernel (OVMSA-2013-0039)	Nessus	OracleVM Local Security Checks	high
68135	Oracle Linux 5 : kernel (ELSA-2010-0839)	Nessus	Oracle Linux Local Security Checks	medium
60886	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
59153	SuSE 10 Security Update : the Linux kernel (ZYPP Patch Number 7261)	Nessus	SuSE Local Security Checks	high
56508	VMSA-2011-0012 : VMware ESXi and ESX updates to third-party libraries and ESX Service Console	Nessus	VMware ESX Local Security Checks	high
52474	Ubuntu 6.06 LTS : linux-source-2.6.15 vulnerabilities (USN-1071-1)	Nessus	Ubuntu Local Security Checks	high
51158	SuSE 10 Security Update : the Linux kernel (ZYPP Patch Number 7257)	Nessus	SuSE Local Security Checks	high
50807	CentOS 5 : kernel (CESA-2010:0839)	Nessus	CentOS Local Security Checks	medium
50537	RHEL 5 : kernel (RHSA-2010:0839)	Nessus	Red Hat Local Security Checks	medium
801500	CentOS RHSA-2010-0839 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2010-3086

medium

Tenable Plugins

high

high

medium

medium

high

high

high

high

medium

medium

high